Main is usually a function, so when is it not? (2015)

Re:Main is usually a function, so when is it not? (2015) by poizan42 on Sunday September 10, 2017 @03:50PM (#15213979)

It is not really there in the ELF. It exists as a section. But sections are not used at runtime, they only exists for tools like debuggers etc. You can strip them from the binary with e.g. the sstrip[0] tool and it still works fine.

What is used at runtime is the program headers named LOAD, which specifies the segments. Here is an example:

    LOAD off    0x0000000000000000 vaddr 0x0000000000400000 paddr 0x0000000000400000 align 2**21
         filesz 0x000000000000069c memsz 0x000000000000069c flags r-x
    LOAD off    0x0000000000000e10 vaddr 0x0000000000600e10 paddr 0x0000000000600e10 align 2**21
         filesz 0x0000000000000220 memsz 0x0000000000000650 flags rw-

...

    Idx Name          Size      VMA               LMA               File off  Algn
      25 .bss         00000420  0000000000601040 0000000000601040  00001030  2**5
                      ALLOC

So note that .bss is placed at the end of the second segment (.bss at 0x601040 + 0x420 = 0x601460, and the second segments ends in memory at 0x600e10 + 0x650 which is also 0x601460). But note also that the file size is only 0x220, which places the end of the data mapped from the file at 0x600e10 + 0x220 = 0x601030 which is slightly before .bss starts. So what happens is that the information about .bss is actually described by setting the memory size of the LOAD segment bigger than the file size, the dynamic linker will then fill the rest with zeroes.

[0] http://www.muppetlabs.com/~breadbox/software/elfkickers.html

[ Parent | on HN ]

Re:Main is usually a function, so when is it not? (2015) by dfox on Sunday September 10, 2017 @04:10PM (#15214087)

I stand corrected about real linker behavior :) In fact merging all RW sections into one big segment with .bss at the end makes perfect sense.

My point was essentially that for ELF this is not some kind of kludgeish special case for .bdd, but general feature that any segment can be zero extended to arbitrary size larger than what is contained in the executable image (although on sane platforms it is not useful for anything but .bss)

[ Parent | on HN ]